10,000+ Unpatched Fortinet Firewalls Under Active Exploit as AI Ransomware Spreads

Active exploitation targets Fortinet, Cisco, VMware at scale

Trend Micro's Q1 2026 threat intelligence report confirms what security teams feared: ransomware operators have integrated agentic AI into attack chains, automating reconnaissance and lateral movement, while simultaneously exploiting critical vulnerabilities in widely deployed infrastructure. More than 10,000 internet-exposed Fortinet devices remain unpatched for CVE-2020-12812, a two-factor authentication bypass in FortiOS that grants direct VPN and administrative access. The same report flags active exploitation of a new Cisco zero-day (CVE-2026-20274) and critical VMware hypervisor vulnerabilities, creating immediate patching demands across enterprise perimeter and data center stacks.

This is not a theoretical risk. Trend Micro documented a 65% year-over-year increase in ransomware incidents against government bodies, with 208 confirmed attacks in H1 2025. The defining shift in Q1 2026 is the integration of agentic AI into criminal ecosystems, enabling faster initial access and more automated exploitation of the same infrastructure vulnerabilities enterprises rely on for perimeter defense and virtualization.

Budget reallocation already underway

The guidance to audit and patch all internet-facing Fortinet, Cisco, and VMware systems critically means CISOs are reallocating near-term budgets toward emergency professional services engagements for rapid assessments, virtual patching, and network segmentation. Discretionary projects—new tooling, long-term architecture initiatives—are being deferred as security teams divert funds to remediation and renewal of vendor support contracts required to access patches and threat intelligence.

Fortinet serves over 700,000 customers globally. Cisco and VMware each anchor thousands of enterprise networks. The volume of exposed devices and the specificity of Trend Micro's CVE callouts mean large enterprises are now asking vendors and managed detection and response partners how quickly they can detect exploit attempts against these exact vulnerabilities, and whether they provide automated, prioritized patch guidance linked to real-world exploit telemetry.

Competitive pressure on perimeter and virtualization vendors

Active exploit campaigns against Fortinet firewalls, Cisco network devices, and VMware hypervisors create competitive leverage for vendors able to demonstrate faster patch turnaround and integrated exposure management. Palo Alto Networks, Check Point, and Juniper compete directly with Fortinet and Cisco in next-generation firewalls and SD-WAN security. Microsoft, Nutanix, and Red Hat compete with VMware in virtual infrastructure. Buyers reevaluating perimeter and data center architectures are now weighing diversified vendor strategies over concentration in a single stack, particularly when that stack is under confirmed exploitation.

Vendors offering cloud-native microsegmentation, continuous threat exposure management platforms, and verifiable resilience metrics gain messaging leverage in this environment. Palo Alto's Cortex-driven patch analytics and SentinelOne's behavioral detection positioning reflect this shift. Buyers are not simply looking for faster patches—they want proof that detection, response, and exposure management are tightly integrated and operationally fast.

AI-driven ransomware changes authentication and resilience priorities

The integration of agentic AI into ransomware operations—automating reconnaissance, initial access, and lateral movement—shifts budget priorities beyond perimeter patching. CISOs are now justifying increased spend on phishing-resistant authentication (FIDO2, passkeys), privileged access management, and hardened backup and restore capabilities rather than incremental perimeter tooling. The reasoning is straightforward: if attackers automate initial access and move laterally faster, signature-centric defenses and traditional multi-factor authentication are insufficient.

This explains the rise in demand for behavioral and AI-driven detection platforms, security orchestration and automated response capabilities, and identity-centric controls. SentinelOne, CrowdStrike, and Microsoft are positioning these as differentiators, and the Trend Micro data provides the justification buyers need to shift budget from legacy tools to identity and resilience infrastructure.

What to watch

Track patch availability and time-to-fix for CVE-2020-12812 and CVE-2026-20274. If Fortinet or Cisco cannot reduce the count of exposed devices significantly within 30 days, expect accelerated evaluations of alternative vendors and managed detection services. Monitor whether VMware (now Broadcom) provides specific remediation guidance tied to the Trend Micro findings, or whether enterprises begin migrating workloads to hyperscalers or Nutanix to reduce exposure.

Watch for regulatory pressure. If agentic-AI-driven ransomware incidents spike in sectors with mandatory reporting requirements—financial services, healthcare, critical infrastructure—expect new disclosure rules and executive liability provisions that further elevate continuous exposure management and identity controls as board-level budget priorities. The combination of automated attacks and legacy infrastructure vulnerabilities creates a scenario where doing nothing is no longer defensible.